SOC work is the discipline of turning scattered evidence into a concise, defensible action. This challenge-only review project tests whether you can move from packet data and host logs to incident attribution, then translate an observed attack pattern into a validated Snort alert.
Across three independent scenarios, you will reconstruct a cleartext HTTP login from a PCAP, correlate audit, authentication, and integrity evidence, and write a focused directory-traversal signature. Each challenge finishes with a small handoff artifact rather than a wall of raw tool output.
What You Will Learn
- Inspect a supplied PCAP with
tcpdumpand isolate a suspicious IPv4 host - Follow a TCP stream with
tsharkand reconstruct an HTTP authentication exchange - Extract a synthetic exposed credential and summarize the confirmed incident
- Interpret a relevant
auditdsyscall record and executable field - Correlate audit evidence with a
sudolog and file-integrity finding - Attribute protected-file activity to the account named in the evidence
- Convert an observed traversal string into a focused Snort content rule
- Run Snort against an offline PCAP, confirm the alert, and summarize the detection
Who This Course Is For
This intermediate capstone is for learners who have already practiced packet analysis, Linux host auditing, and basic Snort rule writing and now want an independent SOC review. It is challenge-only: tasks and hints are provided, but the tools are not retaught step by step.
Prerequisites: Working familiarity with tcpdump, tshark display/follow workflows, shell text filtering and redirection, Linux audit and authentication log fields, file-integrity reports, and basic Snort rule syntax.
Learning environment: An interactive Ubuntu 22.04 terminal with synthetic PCAPs and log excerpts, tcpdump, tshark, and Snort. All investigations and rule validation use prepared offline evidence inside the lab.
Frequently Asked Questions
Is this suitable as my first SOC course?
Probably not. The project assumes you can choose and adapt familiar commands without a guided walkthrough. Complete the packet-analysis, host-auditing, and Snort fundamentals modules first if those workflows are new to you.
Are the traffic, password, and user attribution real?
No. The PCAP, cleartext credential, audit records, authentication excerpt, usernames, and integrity report are synthetic. They are designed to exercise evidence correlation without exposing real organizational data.
Does the Snort challenge deploy a live IDS rule?
No. You write a local lab rule and validate it against a supplied offline PCAP. Production deployment would also require rule testing across representative traffic, false-positive review, change control, performance assessment, and monitoring.
What deliverables will I create?
You create focused evidence extracts plus three short outcomes: an incident alert summary, a host attribution result, and a defensive detection summary. The project does not require a full case report, dashboard, or SIEM integration.
